Real-world image tagging

• Production tags should be immutable
• <something>-<date> or <something>-<git-sha> are good
• Even <something>-<date>-<git-sha> is good
  • This helps humans trace when it was built and what commit it came from
• Keep offering latest for friendly dev use, but don’t use it in prod
• Build and store PR images with a pr-<number> tag
• Maybe, split "CI builds" and "Production-ready builds" into separate repos or registries
• Docker Metadata Action can do all this

Dependabot helps us keep things up to date

• Dependabot is known for updating your app dependencies
• But it can also be configured via YAML to update GH Action versions
• You likely want it to check monthly or weekly

# .github/dependabot.yml in every repo with GHAs
version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

You can do this in the extra credit slides later

• It supports updating your repos for lots of package ecosystems (full list)
• It can update your Dockerfile FROM base image versions
• It can update image versions in Kubernetes manifests & Helm charts

Concurrency limits can save you money

• Avoid multiple commits in the same branch/PR from running at the same time

• Add this at workflow level, before jobs, in every workflow

# cancel any previously-started, yet still active runs of this workflow on the same branch
concurrency:
  group: ${{ github.ref }}-${{ github.workflow }}
  cancel-in-progress: true

You can do this in the extra credit slides later